This is a note to let you know that I've just added the patch titled virtio_ring: mark ring unused on error to the 5.16-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: virtio_ring-mark-ring-unused-on-error.patch and it can be found in the queue-5.16 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 1861ba626ae9b98136f3e504208cdef6b29cd3ec Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" <mst@xxxxxxxxxx> Date: Thu, 6 Jan 2022 07:57:46 -0500 Subject: virtio_ring: mark ring unused on error From: Michael S. Tsirkin <mst@xxxxxxxxxx> commit 1861ba626ae9b98136f3e504208cdef6b29cd3ec upstream. A recently added error path does not mark ring unused when exiting on OOM, which will lead to BUG on the next entry in debug builds. TODO: refactor code so we have START_USE and END_USE in the same function. Fixes: fc6d70f40b3d ("virtio_ring: check desc == NULL when using indirect with packed") Cc: "Xuan Zhuo" <xuanzhuo@xxxxxxxxxxxxxxxxx> Cc: Jiasheng Jiang <jiasheng@xxxxxxxxxxx> Reviewed-by: Xuan Zhuo <xuanzhuo@xxxxxxxxxxxxxxxxx> Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/virtio/virtio_ring.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/virtio/virtio_ring.c +++ b/drivers/virtio/virtio_ring.c @@ -1197,8 +1197,10 @@ static inline int virtqueue_add_packed(s if (virtqueue_use_indirect(_vq, total_sg)) { err = virtqueue_add_indirect_packed(vq, sgs, total_sg, out_sgs, in_sgs, data, gfp); - if (err != -ENOMEM) + if (err != -ENOMEM) { + END_USE(vq); return err; + } /* fall back on direct */ } Patches currently in stable-queue which might be from mst@xxxxxxxxxx are queue-5.16/virtio-virtio_mem-handle-a-possible-null-as-a-memcpy-parameter.patch queue-5.16/vdpa-mlx5-fix-wrong-configuration-of-virtio_version_1_0.patch queue-5.16/virtio_ring-mark-ring-unused-on-error.patch queue-5.16/vdpa-mlx5-fix-config_attr_mask-assignment.patch queue-5.16/vdpa-mlx5-restore-cur_num_vqs-in-case-of-failure-in-change_num_qps.patch queue-5.16/ifcvf-vdpa-fix-misuse-virtio-net-device-config-size-for-blk-dev.patch